Comment by brazzledazzle

I think your points are sound but it’s worth pointing out that you can roll new host OS’s and VMs without patching on-prem too. You just have to have the discipline to run your internal data center the way cloud providers do. You can even take advantage of one of the few benefits of on-prem and roll a fresh host OS without downtime for the VMs running on it by using live migrations.